fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/routes/admin/received-invoices.ts

@@ -5,7 +5,7 @@ import { z } from "zod";
 import prisma from "../../config/database";
 import { requirePermission } from "../../middleware/auth";
 import { logAudit } from "../../services/audit";
-import { success, error, parseId } from "../../utils/response";
+import { success, error, parseId, paginated } from "../../utils/response";
 import { parsePagination, buildPaginationMeta } from "../../utils/pagination";
 import { parseBody } from "../../schemas/common";
 import {
@@ -86,11 +86,11 @@ export default async function receivedInvoicesRoutes(
         prisma.received_invoices.count({ where }),
       ]);
 
-      return reply.send({
-        success: true,
-        data: invoices,
-        pagination: buildPaginationMeta(total, page, limit),
-      });
+      return paginated(
+        reply,
+        invoices,
+        buildPaginationMeta(total, page, limit),
+      );
     },
   );
 
@@ -132,7 +132,16 @@ export default async function receivedInvoicesRoutes(
         let total = 0;
         for (const inv of invs) {
           const amount = Number(inv[field]) || 0;
-          total += await toCzk(amount, inv.currency);
+          // `toCzk` throws on an unknown/unsupported currency. A single bad row
+          // must not 500 the whole stats endpoint — log and skip it instead.
+          try {
+            total += await toCzk(amount, inv.currency);
+          } catch (e) {
+            request.log.warn(
+              e,
+              `Přeskočen převod na CZK pro měnu "${inv.currency}" ve statistikách přijatých faktur`,
+            );
+          }
         }
         return Math.round(total * 100) / 100;
       };
@@ -391,10 +400,9 @@ export default async function receivedInvoicesRoutes(
           amount,
           currency: body.currency ? String(body.currency) : "CZK",
           vat_rate: vatRate,
-          vat_amount:
-            vatRate > 0
-              ? Math.round(((amount * vatRate) / 100) * 100) / 100
-              : 0,
+          // `amount` is the GROSS total (VAT included); VAT is the portion
+          // within it — consistent with the multipart create and update paths.
+          vat_amount: vatFromGross(amount, vatRate),
           issue_date: body.issue_date
             ? new Date(String(body.issue_date))
             : null,